devopsy.kinsta.cloud

Tag: IT operations

OpsRamp Adds Recommendation Engine to AIOps Platform

OpsRamp added a recommendation engine to its artificial intelligence for IT operations (AIOps) platform that makes use of predictive analytics to suggest potential actions to either improve performance or avert downtime.

The OpsRamp Winter 2020 Release also adds 19 cloud monitoring integrations for Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP), along with dynamic topology maps for Azure and GCP. OpsRamp currently provides integrations with more than 120 different cloud services.

Finally, OpsRamp has added an ability to detect seasonality patterns that would otherwise generate alerts, an Alert Stats widget that makes it easier to keep track of raw alerts, synthetic monitoring and agentless discovery and monitoring of Windows Server instances.

Bhanu Singh, senior vice president of engineering and DevOps at OpsRamp, said as IT continues to become more complex resistance to AI within the ranks of IT staffs is declining. Organizations realize that IT specialists are an expensive resource, so they need to maximize the capabilities of IT generalists as much as possible, he said. OpsQ Recommend Mode adds a predictive analytics module to the company software-as-a-service (SaaS) platform for managing IT that provides explainable and transparent analytical recommendations to help the average IT administrator head off issues that would require a specialist to solve later, said Singh.

That visibility is critical because it still leaves the decision about what to automate in the hands of the IT administrator. However, as OpsRamp continues to learn the nuances of the IT environment, the more confidence IT administrators will have in the recommendations being surfaced, he said.

It takes about 24 to 48 hours for the OpsRamp platform to learn enough about an IT environment to start surfacing recommendations, Singh noted, adding because OpsRamp is a SaaS platform, setting up the platform requires minimal effort.

To some degree an increased reliance on AI among IT professionals is inevitable. AI may never eliminate the need for IT personnel, but many of the mind-numbing rote tasks that IT administrators perform today soon will be automated. The challenge that creates, however, is the IT staff needs to be able to manage IT at a higher level, which means many entry-level jobs in the IT sector may no longer be required. The challenge then becomes finding IT professionals who have the right level of skills, when many of the entry-level jobs for which they have been trained no longer exist.

In the meantime, a race is clearly on to infuse IT management platforms with machine learning algorithms. Startups such as OpsRamp are looking to supplant legacy IT platforms that were designed for a previous era of IT. However, the providers of those platforms are clearly investing heavily in AI as part of their ongoing modernization efforts. Each IT organization will need to decide for themselves to what degree the rise of AI warrants switching management platforms.

Regardless of the platform selected, however, the one thing IT teams can count on is that AI platforms are only going to get smarter as they continue to evolve.

— Mike Vizard

March 2, 2020
SaltStack Updates Enterprise IT Automation Framework

SaltStack has partnered with Tenable.io to make it possible to pull vulnerability data into the enterprise edition of its namesake IT automation framework.

In addition, version 6.2 of SaltStack Enterprise now integrates with the IT operations analytics platform from Splunk to make it possible to configure the Splunk Universal Forwarder to index and analyze events generated by the SaltStack framework.

The SaltStack Comply compliance management module has also been updated to include content for Windows Server 2012 and Windows Server 2019 platforms that has been certified by the Center for Internet Security (CIS).

Finally, SaltStack Enterprise 6.2 optimizes communications between the Salt Master and the SaltStack Enterprise Operations Framework by adding an intermediate SQLite database layer to queue events. SaltStack says IT organizations should see 20 times-plus improvement in event processing throughput. SaltStack has also added the ability to forward SaltStack events to any Salt Returner, such as a SQL database or local file, to improve performance and maintain high availability.

Mehul Revankar, a senior product manager for SaltStack, said with this update to the enterprise edition of its open source framework the company is leveraging partnerships to enable IT systems to create closed-looped systems. For example, vulnerabilities identified by Tenable.io now can be automatically remediated using SaltStack Enterprise.

Revankar said the goal is to make it easier for IT teams to create an IT process that can be automated at the push of a button. As IT environments become larger and more challenging to manage, IT organizations will need to automate more processes at scale, he said. To achieve that goal, SaltStack is simplifying the process to connect to a wider range of third-party platforms that house the type of data required to automate a closed-loop process.

Naturally, organizations that have embraced DevOps principles are at the forefront of IT automation. Revankar said that as teams of IT professionals converge to drive DevOps and DevSecOps processes, the greater the willingness to employ IT automation frameworks becomes. The goal is to automate as many processes to inject a level of agility that serves to accelerate the rate at which applications are deployed and updated. The challenge organizations have always faced in IT automation is the time it takes to integrate an IT automation framework with relevant data sources.

Revankar also noted resistance to IT automation among rank-and-file members of the IT operations team is declining as the number of applications that need to be managed increases. Most organizations can’t find or afford to retain enough IT personnel to manage IT operations at the level of scale now required. As such, the need to automate as many rote IT processes as possible has become apparent to all. That’s especially critical in the case of vulnerability management, where the amount of time it takes to patch an application directly correlates to a specific level of risk.

There is, of course, no shortage of options these days when it comes to IT automation frameworks. In fact, the decision concerning which IT automation framework to employ now has as much to do with the number of sources that framework can pull relevant data from as much as it does the reliability of the automated processes that framework enables.

— Mike Vizard

February 13, 2020
F5 Networks Launches Next-Gen ADC Based on NGINX

F5 Networks this week launched version 3.0 of its NGINX application delivery controller (ADC) that adds application programming interface (API) management tools, analytics and monitoring tools, a service mesh, a certificate manager, a developer portal and integrations with multiple continuous integration/continuous deployment (CI/CD) platforms.

Ken Bocchino, director of product management for NGINX at F5 Networks, said as the first major update to the NGINX Controller since F5 Networks acquired NGINX last year, the 3.0 release represents a concerted effort to reduce the total cost of DevOps by bundling many capabilities that previously would have needed to be acquired separately.

In addition, NGINX Controller 3.0 reduces the complexity associated with building DevOps workflows because all the components that make up NGINX Controller have been pre-integrated, said Bocchino.

Based on the open source NGINX proxy server, NGINX Controller is the mechanism through which commercial capabilities are provided and supported as part of the NGINX Plus subscription service offered to enterprise IT customers. Previous iterations of ADCs were much more infrastructure-centric than application-centric, noted Bocchino.

While F5 Networks naturally would prefer IT organizations to consume all those services, Bocchino said the ADC has been designed in a modular fashion to enable organizations to consume services exposed as REST APIs as they see fit. A future version of the NGNIX proxy server will be able to support multiple types of service meshes, including the lighter-weight offering created by the NGINX team that will become available later this year as part of NGINX Controller 3.0, he said.

Bocchino noted F5 Networks envisions the NGINX Controller playing a major role in driving further convergence across network operations, security and DevOps teams. NGINX Controller 3.0 facilitates that goal by providing a self-service portal along with role-based access controls and modular workflows that eliminate the need for tickets to be issued to achieve every IT task.

It’s not clear at what rate that convergence is occurring. However, F5 Networks last year published a survey of DevOps and NetOps teams that suggests there is still a wide gap between NetOps and DevOps teams. The survey found only a little more than a third (38%) of DevOps teams cited the “integration of toolsets across vendors/devices” as a challenge to network automation. In contrast, almost half of NetOps respondents (47%) noted a lack of integration as a problem, second only to a lack of automation expertise (49%).

F5 Networks by acquiring NGINX is betting than most organizations that have already embraced NGINX proxy server software would rather extend those existing capabilities versus replacing their ADC with a new stack of software based on, for example, the rival open source Envoy proxy server being developed under the auspices of the Cloud Native Computing Foundation (CNCF).

How the proxy server war and associated ASC platform wars will play out is still anybody’s guess. What is clear is that DevOps teams will need to access a wide range of programmable networking and security services easily to take DevOps to the next level.

— Mike Vizard

January 28, 2020
Red Hat Bolsters RHEL 8 Monitoring

Red Hat is looking to expand the number of organizations embracing best DevOps practices by expanding the monitoring capabilities included in Red Hat Enterprise Linux (RHEL).

The beta release this week of RHEL 8.2 includes an update to Performance Co-Pilot (PCP), a system performance toolkit that now includes collection agents for Microsoft SQL Server 2019 databases.

Scott McBrien, a principal product manager for Red Hat, said by extending the scope of the performance toolkit, Red Hat is looking to make it easier for IT generalists and developers to collaborate across silos to better maintain application performance levels. Support for Microsoft SQL Server 2019 is an outgrowth of the alliance Red Hat formed with Microsoft way back in 2015. However, McBrien said IT organizations should expect Red Hat to continue to expand the reach of PCP.

RHEL 8.2 Beta also simplifies the process of invoking the Red Hat Insights analytics service during the installation process and provides tighter integration with the extended Berkeley Packet Filter (eBPF) to better analyze network traffic.

Finally, the latest version of RHEL extends an Applications Stream capability to segregate runtimes and languages to additional programming environments and provides a tool to test in-place upgrades to RHEL 8 from RHEL 6/7.

McBrien said Red Hat is trying to keep to a six-month upgrade cycle of RHEL to provide IT organizations with a more predictable timetable. Of course, most of Red Hat customers are still running RHEL 6/7 releases. However, as the rate at which applications are built, deployed and updated continues to accelerate in the age of DevOps, the more pressure there will be on IT teams to maintain application performance levels across an increasingly extended enterprise. Inevitably, IT generalists will need access to a broader range of observability tools at all layers of the stack to keep pace.

Adoption of DevOps practices across the enterprise remains uneven at best. However, as more IT generalists are exposed to richer monitoring tools at the operating system level, the easier it becomes to augment or supplant legacy ITIL-based approaches to managing IT. In fact, as tools at the disposal of IT generalists become more sophisticated, the need to rely on various classes of IT specialists declines. Most IT organizations are especially keen to achieve that goal because labor stubbornly remains the single biggest cost of IT.

It remains to be seen to what degree the management of IT will be transformed in the months and years ahead. The one thing that is certain is IT will become more complex as new architectures based on microservices and serverless computing frameworks get adopted. Each additional layer of abstraction may make it easier for developers to build applications, but from the perspective of the IT operations teams, they tend to increase dependencies between systems that are already fairly fragile. The challenge now is to identify where bottlenecks exist between all those systems before a degradation in application performance becomes a full-blown catastrophic event.

— Mike Vizard

January 24, 2020
Edge Computing and ITOps: Opportunities and Challenges

Edge computing is growing quickly, but IT operations need to evolve as well to effectively monitor and manage new devices, sensors, applications and data. Growing enterprise edge ecosystems should integrate and become part of centrally managed ITOM systems.

Edge computing is hard to define and is running high on the hype scale. But, research and surveys continue to indicate that this trend of processing data where it’s collected for better latency, cost savings and real-time analysis is an innovation with legs.

There will be 75 billion IoT devices by 2025, according to Statista. According to Spiceworks’ 2019 State of IT report, 32% of large enterprises with more than 5,000 employees are using edge computing, and an additional 33% plan to adopt it by 2020. Tied to the growth of edge computing is the advent of 5G wireless: 51 operators globally will start 5G services by 2020, according to Deloitte Global research from 2019.

The major cloud companies are also investing in the edge. The AWS Local Zones service allows single-digit latency connecting to computing resources in a metro environment, while Microsoft offers the Azure Stack Edge appliance and Google Cloud IoT is a “complete set of tools to connect, process, store and analyze data both at the edge and in the cloud.”

It’s safe to say that edge computing is becoming mainstream, and CIOs and their ITOps leaders should plan appropriately for it in 2020 and beyond.

Benefits of the Edge for ITOps

We’ve read plenty about the business benefits from edge computing: oil rig operators need to see critical sensor data immediately to prevent a disaster, marketers want to push instant coupons to shoppers while in the store, video security monitoring can catch a thief in the act and medical device alerts that ensure patient safety. Edge computing may save IT money on cloud and network bandwidth costs as data volumes keep exploding and the need to store every data point becomes harder to justify.

There are also implications for IT management and operations. Local processing of high volume data could provide faster insights to manage local devices and maintain high-quality business services when seconds make a difference—such as in the event of a critical server performance issue threatening the e-commerce site.

Today, ITOps teams are inundated with data from thousands of on-premise and cloud infrastructure components and an increasingly distributed device footprint. The truth is, only an estimated 1% of monitoring data is useful, meaning that it provides indications of behavior anomaly or predictions about forthcoming change events. With edge monitoring, we can potentially program edge-based systems to process and send only that small sliver of actionable data to the central IT operations management system (ITOM), rather than transmitting terabytes of irrelevant data daily to the cloud or an on-premise server where it consumes storage and compute power.

The job of filtering out the highly-contextual data on the edge, where business occurs, can support real-time decisions for successfully running ITOps at speed and scale—regardless of what combination of on-premise, public cloud or private cloud infrastructure is in place. At the same time, ITOps will need to be a leader when it comes to minimizing the risk of edge technology from a performance, security and privacy perspective. However, as detailed below, we are in the early stages of determining how to make this work in practice.

ITOps Realities for Edge Computing

Edge-Specific Security Needs Are Still Unknown: Edge devices are often small and infrequently designed with security in mind. More than 70% of edge devices don’t mandate authentication for third-party APIs, and more than 60% don’t encrypt data natively. So the attack surface in IoT and edge environments is now larger, and less secure. This is particularly worrisome when considering edge devices that collect personally identifiable information such as email, phone numbers, health data or financial formation such as credit card data. ITOps will need to work closely with security and legal teams to map out the company-specific risk, governance and compliance requirements around managing edge data.

Edge Monitoring Tools Are Immature: Companies need platforms that can instantly monitor and analyze edge-generated data. In the connectivity of tomorrow, billions of connected devices will be communicating machine-to-machine, and the addition or subtraction of connected devices will be possible at an unprecedented scale. In this environment, the ability to manage large volumes of connected devices and the information being exchanged between them will be critical. 5G acts as the unifying technology, bringing flow of information and the density of scale. We will see an influx of innovation in edge monitoring in the coming years.

New Environments Call for New Rules: As organizations move more data and application assets to edge computing environments, IT will need to devise new policies and thresholds for central processing and alerting of all this data. Applying AI-based automation is essential here, as manual efforts will have zero chance of keeping up with the volume of data filtering, analysis and response. We are entering the age of nano satellites, vis-à-vis SpaceX and OneWeb. These edge devices will transform the future of agriculture, energy, mining, transportation and finance due to their capabilities for sending insightful data in real-time to customers, wherever they are at any moment. ITOps will have its work cut out to understand and properly manage this evolving edge infrastructure.

DevOps Processes Will Become Even More Paramount: If you haven’t already realized that DevOps is taking over software development and IT management, just wait for when edge goes mainstream. There will be no other way to manage change and deployments of edge technology without the agile, continuous integration and continuous delivery methodology of DevOps. It will be imperative for ITOps to adopt DevOps practices and tools to manage, monitor and deploy edge resources.

ITOps is at a crossroads, determining how much of the past is still relative and how much they will need to change to adapt to a distributed, hybrid cloud world that will soon include edge as a fundamental pillar of their digital strategy. Security, machine intelligence and DevOps will be crucial areas of expertise for ITOps teams looking to help drive better business value and customer experiences from the edge.

— Bhanu Singh

January 22, 2020
LogicMonitor Acquires Unomaly to Advance AIOps

LogicMonitor this week revealed it has acquired Unomaly, a provider of tools infused with machine learning algorithms that make it easier to analyze large volumes of log data.

Tej Redkar, chief product officer for LogicMonitor, said the acquisition of Unomaly will advance a previously announced AIOps initiative through which LogicMonitor will embed advanced analytics and automation capabilities into its core IT monitoring platform. Rather than requiring DevOps teams to acquire a separate platform to take advantage of AIOps, LogicMonitor contends AIOps is simply an element of the next logical iteration of an IT monitoring platform.

Unomaly will help LogicMonitor achieve that goal by identifying patterns in streaming log data that are indicative of anomalies that warrant further investigation, said Redkar. Unomaly works by first establishing a baseline for the IT environment. It then records a profile for each log event that includes the event’s structure, sources, frequency patterns and intervals. Similar profiles are then merged into one aggregated profile, with dynamic parameters to reduce the amount of data that needs to be analyzed by several orders of magnitude. If an anomalous event occurs within a rolling 60-second window on a single log source, Unomaly will bring those events together to identify and score a situation based on the type and number of anomalies.
Redkar noted this approach not only provides more context about the events but it also greatly reduces the amount of log data that needs to be stored. Unomaly is also designed to accept data in any format.

As IT becomes increasingly more complex, organizations of all sizes need more observability. However, because all the dependencies within the IT environment are becoming too complex to track manually, IT organizations will need to rely more on machine and deep learning algorithms to observe the IT environment.

Naturally, that increased reliance on algorithms will alter the role of IT operations teams. Most IT operations teams will find themselves supervising algorithms that are surfacing issues and making recommendations, said Redkar. Rather than eliminating the need for IT operations expertise, AIOps will be employed mainly to manage IT environments operating at a significantly higher scale, he noted.

It will take some time for this transition to play out as issues such as the explainability of AI models are worked out. Some of the lower-level functions within an IT operations environment undoubtedly will be eliminated, so job roles will change. However, many of those functions will be rote tasks that many IT professionals don’t especially like to perform.

IT vendors are, of course, involved in something akin to an algorithms arms race to infuse AI into their management platforms. In some cases, they will develop these capabilities themselves. In other cases, they will acquire startups to gain access to AIOps platforms. Most IT vendors will be mixing and matching a variety of AI technologies they developed themselves and acquired. Regardless of the path pursued, it’s no longer a question of whether AIOps will be applied to managing IT, but rather when.

— Mike Vizard

January 17, 2020
SaltStack Extends IT Automation Framework

SaltStack today added three open source modules to its portfolio that make it easier to automate the management of IT at scale.

Heist is a plugin that allows organizations to create agents that will dissolve after a specific amount of time. Umbra is a plugin that gathers data streams to make it easier for machine learning algorithms to consume.

Finally, Idem is a declarative programming language that enables IT teams to create workflows based on stateful constructs that can be used in conjunction with any IT automation framework or systems management tool.

All three modules are based on the Salt Plugin Oriented Programming (POP) model. Company CTO Thomas Hatch said SaltStack created POP to make it easier to manage modules and libraries of code within a monolithic application without having to transition to a different microservices-based architecture based on containers.

That POP approach also serves to make it easier to test modules within a monolithic application environment, he said.

SaltStack used POP to create Salt, an open source IT automation framework that serves as the foundation for the commercial IT automation platform provided by SaltStack. Organizations that have embraced the open source Salt project include Juniper Networks, Cloudflare, Nutanix, SUSE, LinkedIn and eBay.

Heist extends the Salt project by giving DevOps teams an alternative to having to commit to either an agent or agentless-based approach to managing IT. Instead, DevOps teams can create an agent to collect data that will run only as long as it’s needed.

Umbra, meanwhile, prepares data to be consumed by machine learning algorithms transparently, which Hatch said is critical in providing visibility into how artificial intelligence (AI) models are constructed. That capability is going to be a requirement in any regulated industry that requires organizations to comply with IT audits, he noted.

IT automation frameworks are, of course, foundational to any set of best DevOps practices. While most of the initial IT automation management frameworks were proprietary, the entire category has gained more traction as open source implementations of these frameworks became available. Now DevOps teams have a plethora of open source and commercial IT automation frameworks on which to define a set of DevOps processes.

The biggest challenge in getting IT teams to embrace these frameworks historically has been the preference of many IT professionals for scripts they develop. However, as the scale of the IT management challenge has increased in the age of the cloud, relying on scripts that are often undocumented has become problematic. Industrial-scale IT organizations require IT automation frameworks that allow them to create reusable playbooks that are easily documented. Otherwise, every time an IT professional who authored a script leaves the company, the IT organization soon discovers the script they’ve been relying on that has broken can’t be fixed easily.

The day when all IT organizations rely on some form of an IT automation framework is fast approaching. In fact, the remaining IT automation challenges have a lot more to do with the culture within the IT organization than they do any of the technical capabilities of the platforms being considered.

— Mike Vizard

January 15, 2020
How to Use DevOps for Compliance

Picture this: You’ve been working in an organization’s IT department for a couple of years and tasks have become quite a routine. Some documentation here and there, code reviews, end-user training, routine meetings with the developers and so on. You can do literally everything with your eyes closed.

Then, all of a sudden, the company is going public and you feel like you’ve been thrown into a different dimension. There are new procedures to follow, endless meetings to attend and a ton of paperwork to be shipped. And don’t forget the new compliance regulations.

When this happens, do you gamble and quit or stick around and accept the new reality? Is there a truly viable option?

In comes DevOps.

DevOps means different things to different companies. Some IT experts consider it a fad while others swear of its significance.

In many organizations, DevOps combines development and operations. With it comes automation, efficiency and more transparency. With DevOps, changes can be rolled out much quicker.

DevOps can be the silver bullet for organizations looking to keep up with HIPAA, GDPR, PCI SOX and other industry regulations.

Here are four strategies for using DevOps for compliance.

Keep Track of Documentation

A big part of compliance involves documentation. Yes, boring but critical. With a unified development and operations team, you can merge the documentation processes of those who release changes and those who make them. It’s also easier to get everyone on board when it comes to compliance requirements.

You can use the newfound synergy between dev and ops to avoid documentation bottlenecks by adopting a unified and trackable version control system. Tools such as Git, wiki pages and internal dashboards can be used to harmonize documentation and version control.

Make sure everyone is on board by conducting routine training and holding meetings involving both dev and ops personnel.

Leverage DevOps Automation

Part of the reason why DevOps has attracted so much attention is the automation it brings.

With DevOps, time-consuming tasks such as monitoring pull requests, internal audits, access controls, code reviews, failovers and code coverage can be optimized through a transparent, unified and automated system. For instance, you can link all deployments, code review and build results in a single process to streamline audits and daily operations.

DevOps automation not only helps to streamline internal processes but also in demonstrating that you have met all compliance requirements. Things like access control and failover/recovery processes can stifle your compliance efforts if they are not optimized through automation.

Streamlining Dev Workflows for Compliance

Most compliance problems stem from messy development workflows that are not helpful for those keeping track of updates. For instance, an update that is put into production without going through the normal stress tests or internal reviews is not helpful. With multiple teams working on different features during the development stage, it’s easy to overlook small updates that could potentially introduce vulnerabilities.

DevOps helps to prevent accidental compliance breaches emanating from flawed dev workflows. This is achieved through the integration of stress testing into the development process itself.

With DevOps, you don’t have to wait until an update is ready for production to stress test it. Working with a dedicated compliance team, you can create a compliance blueprint in the form of a testing and logging system to keep track of code that is still in the production stage way before it goes into production.

Foster a Compliance Culture

In a non-DevOps environment, it’s common for different teams or individuals to blame each other, refuse to take responsibility or be out of touch with processes that are not in their job description or assignment. To ensure compliance, a bit of team management is required through communication and culture development.

DevOps makes this process easier thanks to the improved inter-team dynamics, automated processes and increased transparency. It’s easier to merge the dev and ops teams to help identify potential trouble spots and ways of resolving them. The operations staff will not blame the developers when a disaster occurs if they were part of the entire process and vice versa.

Effective teams always take responsibility instead of looking for a fall guy or starting finger-pointing when something is amiss. Inculcate a culture of compliance in your teams by ensuring that they are all aware of what is required of them and their shared responsibilities.

From the above, it is clear that DevOps can be the only thing you need to ensure compliance in your organization. However, adopting multiple recommendations at a go can be challenging. Therefore, take it one step at a time and use available tools, such as Git, to implement some of these processes.

— Ken Lynch

January 15, 2020
Five IT Ops-tackles that Stifle Business Growth

I was recently asked about the top five IT obstacles that stifle business growth, and I want to help clear a path too often lined with fear, uncertainty and doubt. In the not-so-distant past, IT was all about the tools. Solutions were more straightforward, teams were less globally connected, and the ever-present data deluge was not changing our business landscape by the millisecond.

With this in mind, I have created a list of the five most common IT obstacles and will pinpoint the single tool you can implement to help alleviate these pain points.

IT Staff Lack Time to Learn New Technologies

This is not to slam our tech teams or leaders; this is just the byproduct of condensed customer schedules, tight purse strings and managing the MOOSE (maintenance and operations of the organization, systems and equipment). The demand on IT teams is high, and we don’t always have the opportunity or the resources to restructure operations for a new tool, as upgrading requires learning new APIs, UI/UX and deployment architectures.

Difficulty Supporting New Technologies Quickly

It is hard to keep pace with IT complexity and manage it properly. New services, applications and infrastructures are constantly being added and there are plenty of vendors out there that will get you locked into solving a single issue versus addressing your macro problems. While the benefits of upgrading are there, the difficulty lies in understanding the complexity of these systems and how to leverage them most effectively.

Lack of Support for Hybrid IT

Hybrid by definition adds complexity, and multi-cloud, on-prem and private/public clouds are only a few ways to make your hybrid dream a nightmare. No matter the combination, understanding different architectures and their components is a must. Additionally, we need to understand how we manage our own data as well as how our vendors are managing it.

IT Complexity

We need to know our machines and architectures well enough to focus limited resources on what impacts the business most. IT will always be complex—there’s always something new, and the amount of information to process is insurmountable and exhausting. Adding context to IT data can help you identify the root cause of overly complex systems. The most difficult task will be to understand the technology well enough to know what to do next.

Inability to Understand Business Impact in Order to Prioritize Tasks

Prioritization is by far the most important aspect of IT. There is a lot of noise, lack of visibility, lack of context, and—the squeakiest wheels of them all—legacy tools. Prioritizing means routing the right people to the right problem to get it solved quickly and elevating IT service visibility, health and risk into the business function.

Let’s Get Digital

IT pros can start to tackle these challenges through prioritization and then automation, or AIOps—the principal of AIOps being to add context to data, using machine processes to enrich the data and bring it to a business level. Understand what is important to the organization and think about the outcomes important to IT. To do this, you can create a realization plan to tackle the low-hanging fruit and create achievable milestones and outcomes. For example, look for opportunities and create a crawl-walk-run phased approach driven by business priorities. Each organization has different needs and different timelines—and this process can be applied to customers, too.

Next, take into account how your team does work and focus on automation as a principle within how you do work. One of the biggest impediments to digital transformation is culture. Remove manual processes, capture tribal knowledge and figure out how to repeat this approach in a consistent way. Additionally, absorb feedback and learn from it. This will drive acceleration when done right, and we all know that better digital experiences boost enterprise value.

Finally, automation is useless if your data is flawed, and accuracy is a key fault for legacy configuration management database systems. Data must be accurate for effective machine-enabled automation. Leverage the tech you have to build an interconnected ecosystem that is fully integrated and automated—and that avoids tool sprawl. Have an open mind to consider new approaches and be brave enough to shed the legacy mindset. Additionally, take into consideration your partners and vendors, and how that team collaborates, to determine your strategy.

The Light at the End of the Tunnel

The path for today’s CIO can be unclear. But you can take bite- (or “byte-”) sized steps to put machines to work and leverage processes that deliver on AIOps. By understanding business outcomes, prioritizing automation as a principle and leveraging trustworthy internal and external relationships, you will have more time in the day for more important tasks. I measure outcomes based on customer experiences, and I ensure great customer experiences by running a great system. While your mileage may vary, moving forward is the most important part.

— Erik Rudin

January 13, 2020
DevSecOps Requires Teamwork for Success

While the manifestos surrounding the current development pipelines may differ, there is one concept that remains constant: teamwork. All the various frameworks populating the development landscape bring together teams of people to build and deliver applications. This is especially true of DevOps, which focuses on a technical culture with defined roles on a quest for responsiveness.

Yet, many organizations seem to be failing miserably when it comes to bringing cybersecurity into IT operations, especially where DevOps is concerned. New research from Tanium, a purveyor of endpoint management and security platform solutions, illustrates that all is not well where cyber and IT operations intersect.

Tanium commissioned Forrester Consulting to survey more than 400 IT leaders at large enterprises to uncover the challenges, consequences and gaps they face when managing and securing their endpoints. That research revealed that two-thirds (67%) of businesses say that driving collaboration between security and IT ops teams is a major challenge.

That lack of collaboration has a cascading effect, impacting the overall security hygiene of the enterprise and exposing systems to even common threats. Simply put, teamwork requires much more than just building camaraderie between security, operations and development folks; success requires that various team members come together to support the culture of DevOps.

Strained relations between those players can lead to security failures, an assumption evidenced by Tanium’s research. The survey results indicated that security and IT ops teams with strained relationships more often struggle with basic IT hygiene, taking nearly two weeks longer to patch IT vulnerabilities than teams with healthy relationships.

It is those types of issues that can weaken the confidence of IT decision-makers to make the correct decisions. The report claims that they have a misplaced sense of confidence, with 80% certain they can act on the results of vulnerability scans but only 49% feel confident they have full visibility into all the hardware/software assets on their environment.

According to Tanium, that misplaced confidence is attributable to the increased investment in IT security and operational tools. However, just increasing security budgets does not always deliver on improved capabilities. As the survey results indicate, throwing money at the cybersecurity problem often creates a false sense of security regarding how well businesses can protect their IT environment from threats and disruption.

Many of those threats seem to fall through the cracks, a problem often blamed on the lack of end-to-end visibility of endpoints and their health. Solving that particular issue requires that IT security professionals interact more effectively with their IT operations and development counterparts (again, teamwork). Further exacerbating the problem is that many applications and services still operate in silos, which inhibits the visibility and control needed to properly protect the environment.

“According to our research, most teams are confident in their ability to take timely action on the results of their vulnerability scans. However, further investigation shows teams are admittedly suffering from visibility gaps of all hardware and software assets in their environment, which undermine these efforts to take action. With around 50% of IT leaders showing confidence in asset and vulnerability visibility, you’re essentially leaving your security to a coin flip,” said Chris Hallenbeck, Americas Chief Information Security Officer at Tanium.

Ultimately, Tanium recommends adopting a unified endpoint security solution to address the gaps in protection, while also encouraging security and IT ops teams to work more closely together. However, it is likely it will take more than just that to fully integrate security into the DevOps pipeline. Cybersecurity pros will need to get involved in the development pipeline to ensure that security becomes a foundational element of the application development and delivery process.

— Frank Ohlhorst

December 2, 2019